Incidents

A Web of (Mis)Trust?

At our international press tour held in Moscow in early February, we spoke about the dissolution of trust on the internet and discussed
the possibility of Certificate Authority subversion and the impact of abused digital certificates.

Our speculation was partly driven by the abuse of trust that Kaspersky Lab monitored and prevented by the stolen Stuxnet digital certificates.

This unfortunate moment is arriving sooner than we wanted. This past week, another concrete example of the very foundation of trust on the web was shaken with the final coordination of an effort between a compromised Certificate Authority and web browser providers. The compromised Certificate Authority and browser developers needed to denylist a set of digital certificates for high value sites that malicious attackers issued for their own use. The end result is that attackers assumed the credibility of some major web presences with the assurance of the Certificate Authority. Mozilla provided brief description of impact: “Users on a compromised network could be directed to sites using the fraudulent certificates and mistake them for the legitimate sites. This could deceive them into revealing personal information such as usernames and passwords. It may also deceive users into downloading malware if they believe it’s coming from a trusted site.”

What does that mean to you? Well, a short list of some of the impacted sites include:
login.live.com
mail.google.com
www.google.com
login.yahoo.com (3 certificates)
login.skype.com
addons.mozilla.org
“Global Trustee”

In a hypothetical scenario, you may have received an email with a link that you clicked on, or your browser may have been redirected to what appeared to be one of these sites. The browser indicated that it trusts the site, so you login with your user and pass. For some reason, you get redirected and login again to the site. At this point, a part of your online identity and access to your email or IM is compromised by an attacker. Again, this is purely hypothetical.

In followup to the event, a crlwatch project has been announced within a corresponding lengthy writeup on the technical matters of the incident.

The crlwatch project itself will help monitor the revocation of certs in response to breaches like this one.

More data is being provided as I write this post. It will be updated as more details come in.

A Web of (Mis)Trust?

Your email address will not be published. Required fields are marked *

 

Reports

APT trends report Q2 2021

This is our latest summary of advanced persistent threat (APT) activity, focusing on significant events that we observed during Q2 2021: attacks against Microsoft Exchange servers, APT29 and APT31 activities, targeting campaigns, etc.

LuminousMoth APT: Sweeping attacks for the chosen few

We recently came across unusual APT activity that was detected in high volumes, albeit most likely aimed at a few targets of interest. Further analysis revealed that the actor, which we dubbed LuminousMoth, shows an affinity to the HoneyMyte group, otherwise known as Mustang Panda.

WildPressure targets the macOS platform

We found new malware samples used in WildPressure campaigns: newer version of the C++ Milum Trojan, a corresponding VBScript variant with the same version number, and a Python script working on both Windows and macOS.

Ferocious Kitten: 6 years of covert surveillance in Iran

Ferocious Kitten is an APT group that has been targeting Persian-speaking individuals in Iran. Some of the TTPs used by this threat actor are reminiscent of other groups, such as Domestic Kitten and Rampant Kitten. In this report we aim to provide more details on these findings.

Subscribe to our weekly e-mails

The hottest research right in your inbox